# Web application firewalls for small business buyers: what AI models recommend, September 2026

Gane Index, September 2026 Edition. Asked as "web application firewall" and as "WAF and bot protection service", six framings each, to twelve models with search on, on behalf of a small B2B company. Page: https://www.gane.ai/index/it/network/web-application-firewalls/2026-09/smb

This is the permanent record of the September 2026 Edition, published September 17, 2026 and superseded since. The current standing: https://www.gane.ai/index/it/network/web-application-firewalls/smb/index.md

**Standing:** Cloudflare WAF leads with 93% of first choices; verdict clear leader. 45 first choices across the direct, paraphrase, budget and scale prompts.

## First-choice share

| Rank | Product | Share | Negative rate | Labels |
|---|---|---|---|---|
| 1 | [Cloudflare WAF](https://www.gane.ai/index/it/vendors/cloudflare-waf/index.md) | 93% | 4% | 67 |
| 2 | [Sucuri WAF](https://www.gane.ai/index/it/vendors/sucuri-waf/index.md) | 4% | 4% | 48 |
| 4 | [AWS WAF](https://www.gane.ai/index/it/vendors/aws-waf/index.md) | 0% | 22% | 41 |
| 5 | [Azure WAF](https://www.gane.ai/index/it/vendors/azure-waf/index.md) | 0% | 18% | 11 |
| 6 | [Fastly Next-Gen WAF](https://www.gane.ai/index/it/vendors/fastly-next-gen-waf/index.md) | 0% | 18% | 11 |
| 58 | [ModSecurity](https://www.gane.ai/index/it/vendors/modsecurity/index.md) | 0% | 60% | 15 |
| 60 | [Imperva Cloud WAF](https://www.gane.ai/index/it/vendors/imperva-cloud-waf/index.md) | 0% | 63% | 35 |
| 61 | [Akamai App & API Protector](https://www.gane.ai/index/it/vendors/akamai-app-api-protector/index.md) | 0% | 71% | 24 |

Rank is by share of first choices among all 61 products named; products with the same share are tied, and the order among them carries no meaning. The table lists those with at least 10 labels.

## Each model's first choice on the direct prompt

- Claude Haiku 4.5: Cloudflare WAF; alternatives AWS WAF
- GPT-5.4 mini: Cloudflare WAF; alternatives AWS WAF, Azure Web Application Firewall
- Gemini 3.5 Flash: Cloudflare WAF; alternatives AWS WAF, Azure WAF, Fastly Next-Gen WAF, Sucuri WAF
- Perplexity Sonar: Cloudflare WAF, Sucuri WAF
- Grok 4.20: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- Mistral Small: Cloudflare WAF; alternatives Sucuri WAF
- DeepSeek V4 Flash: Cloudflare WAF; alternatives Sucuri WAF
- Llama 4 Maverick: Cloudflare WAF; alternatives Sucuri WAF
- Qwen 3.7 Flash: Cloudflare WAF; alternatives AWS WAF, Amazon CloudFront, Imperva Cloud WAF, Sucuri WAF
- Kimi K2: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- GLM 4.7 FlashX: Cloudflare WAF; alternatives AWS WAF, Sucuri WAF
- MiniMax M2.5: Cloudflare WAF; alternatives Imperva Cloud WAF, Sucuri WAF

## Sources the answers cite

64 of 72 answers came back with a source list, from 12 of 12 models. Sites named in the most answers:

- cyberpress.org: 48 answers, 49 citations
- wafplanet.com: 41 answers, 101 citations
- geekflare.com: 32 answers, 33 citations
- openappsec.io: 27 answers, 35 citations
- comparitech.com: 21 answers, 22 citations
- expertinsights.com: 20 answers, 20 citations
- cybersecuritynews.com: 19 answers, 24 citations
- sourceforge.net: 17 answers, 17 citations

Pages named in the most answers:

- https://cyberpress.org/waf-solutions-by-business-size (48 answers)
- https://geekflare.com/cybersecurity/best-web-application-firewall (30 answers)
- https://comparitech.com/net-admin/best-web-application-firewall (21 answers)
- https://expertinsights.com/network-security/the-top-web-application-firewalls (20 answers)
- https://sourceforge.net/software/web-application-firewalls-waf/for-small-business (17 answers)
- https://wafplanet.com/best-waf-for/small-business (17 answers)
- https://wafplanet.com/blog/waf-pricing-comparison-2026 (17 answers)
- https://wafplanet.com/ (16 answers)
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison (13 answers)
- https://cybersecuritynews.com/best-web-application-firewall-solutions (11 answers)

## Warned against

- Akamai App & API Protector: 17 of 24 labels negative. "Enterprise-Grade "Call for Quote" WAFs (e.g., Akamai App & API Protector, F5 Advanced WAF)... Why to avoid them" (Gemini 3.5 Flash, negative prompt)
- Imperva Cloud WAF: 22 of 35 labels negative. "Enterprise-Grade Commercial WAFs (Imperva, Akamai, F5 BIG-IP ASM)
Avoid unless you are being acquired by a Fortune 500 company." (DeepSeek V4 Flash, negative prompt)
- ModSecurity: 9 of 15 labels negative. "Unmanaged Open-Source WAFs (e.g., Raw ModSecurity)... Why to avoid them: While the software is free, the labor is incredibly expensive." (Gemini 3.5 Flash, negative prompt)
- AWS WAF: 9 of 41 labels negative. "The Catch: It requires manual configuration, and AWS Bot Control is charged on a usage basis ... which can get expensive and complex to fine-tune" (Gemini 3.5 Flash, paraphrase prompt)

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, September 2026 Edition, www.gane.ai/index/it.